Regin Analyse

💳 Purchase Required

You need to purchase an additional CTI license to see detailed indicators.

IOB - Indicator of Behavior (113)

Langue

en	108
ko	2
zh	2
es	2

De campagne

us	54
gb	44
cn	8
fr	2
in	2

Acteurs

Regin	1

Intérêt

Taper

Not Defined	42
Programming Language Software	16
Operating System	8
Content Management System	6
Database Software	4

Fournisseur

Not Defined	42
IBM	12
Microsoft	6
Cisco	4
Siemens	4

Produit

PHP	16
Microsoft Windows	4
Vastal phpVID	2
Ashwebstudio Ashnews	2
HMS Ewon eCatcher	2

Vulnérabilités

#	Vulnérabilité	Base	Temp	0day	Aujourd'hui	Exp	Con	EPSS	CTI	CVE
1	Host Discard Service elévation de privilèges	7.3	7.1	$0-$5k	$0-$5k	High	Workaround	0.01500	0.04	CVE-1999-0636
2	PHP Filename DirectoryIterator buffer overflow	5.5	5.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00809	0.04	CVE-2019-11045
3	nginx elévation de privilèges	6.9	6.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00241	3.44	CVE-2020-12440
4	Sonatype Nexus Repository Manager elévation de privilèges	4.9	4.9	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00078	0.02	CVE-2021-43961
5	HP Enterprise LaserJet buffer overflow	7.6	7.6	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00197	0.02	CVE-2021-39238
6	CKeditor Dialogs Plugin elévation de privilèges	6.4	6.1	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00148	0.00	CVE-2021-26271
7	TYPO3 User Session chiffrement faible	5.6	5.4	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00168	0.00	CVE-2021-21339
8	VMware vCenter Server Heartbeat Message elévation de privilèges	5.3	4.6	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.02214	0.02	CVE-2015-1047
9	PAM unix_chkpwd divulgation de l'information	5.3	5.0	$5k-$25k	$0-$5k	Proof-of-Concept	Official Fix	0.00042	0.00	CVE-2005-2977
10	st Module passwd directory traversal	6.4	6.1	$0-$5k	$0-$5k	Proof-of-Concept	Official Fix	0.00672	0.00	CVE-2014-3744
11	Vastal phpVID browse_videos.php cross site scripting	4.3	4.1	$0-$5k	$0-$5k	Proof-of-Concept	Not Defined	0.01566	0.03	CVE-2013-5312
12	GitHub Actions Runner elévation de privilèges	8.3	8.2	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00117	0.00	CVE-2022-39321
13	Oracle Database Server RDBMS Security/SQL*Plus divulgation de l'information	2.6	2.5	$5k-$25k	$0-$5k	Not Defined	Official Fix	0.00069	0.00	CVE-2016-3562
14	Oracle Solaris Common Desktop Environment Format String	8.3	7.9	$5k-$25k	$0-$5k	Proof-of-Concept	Not Defined	0.00043	0.00	CVE-2022-43752
15	Dragon Path Bharti Airtel Routers Hardware BDT-121 Admin Page cross site scripting	3.5	3.5	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00053	0.04	CVE-2022-28507
16	HMS Ewon eCatcher elévation de privilèges	5.5	5.3	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00074	0.00	CVE-2021-33214
17	Wamp Wamp64 elévation de privilèges	7.5	7.4	$0-$5k	$0-$5k	Not Defined	Not Defined	0.00130	0.04	CVE-2022-36565
18	NVIDIA CUDA Toolkit SDK cuobjdump buffer overflow	6.6	6.5	$0-$5k	$0-$5k	Not Defined	Official Fix	0.00091	0.00	CVE-2022-21821
19	Siemens SIMATIC S7-400 Session Cookie httponly divulgation de l'information	5.3	5.3	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00096	0.02	CVE-2016-8672
20	Cisco Small Business Switches authentification faible	8.4	8.4	$5k-$25k	$5k-$25k	Not Defined	Not Defined	0.00243	0.04	CVE-2018-15439

IOC - Indicator of Compromise (7)

These indicators of compromise highlight associated network ressources which are known to be part of research and attack activities.

ID	adresse IP	Hostname	Acteur	Identified	Taper	Confiance
1	17.3.40.93		Regin	01/01/2021	verified	Élevé
2	18.159.0.1	ec2-18-159-0-1.eu-central-1.compute.amazonaws.com	Regin	01/01/2021	verified	Moyen
3	XX.X.X.X	x.x.x.xx.xxx.xxxx.xxx	Xxxxx	01/01/2021	verified	Élevé
4	XX.XX.XXX.XX		Xxxxx	01/01/2021	verified	Élevé
5	XXX.XXX.XXX.XXX	xxxxxxx.xxxxxx.xx	Xxxxx	01/01/2021	verified	Élevé
6	XXX.XX.XXX.XXX	xxxx.xxxxxxxx.xxxxxxxxxxxxx.xxx	Xxxxx	08/06/2021	verified	Élevé
7	XXX.XXX.XX.XX	xxxx.xxxxxxxxxx.xxx	Xxxxx	08/06/2021	verified	Élevé

TTP - Tactics, Techniques, Procedures (15)

Tactics, techniques, and procedures summarize the suspected MITRE ATT&CK techniques used. This data is unique as it uses our predictive model for actor profiling.

ID	Technique	Classe	Vulnérabilités	Vecteur d'accès	Taper	Confiance
1	T1006	CAPEC-126	CWE-22	Path Traversal	predictive	Élevé
2	T1055	CAPEC-10	CWE-74	Improper Neutralization of Data within XPath Expressions	predictive	Élevé
3	T1059	CAPEC-242	CWE-94	Argument Injection	predictive	Élevé
4	TXXXX.XXX	CAPEC-209	CWE-XX, CWE-XX	Xxxxx Xxxx Xxxxxxxxx	predictive	Élevé
5	TXXXX	CAPEC-122	CWE-XXX, CWE-XXX, CWE-XXX, CWE-XXX	Xxxxxxxxx Xxxx Xxxxxxxxxxx Xxxxxxxxxx	predictive	Élevé
6	TXXXX.XXX	CAPEC-191	CWE-XXX	Xxxx-xxxxx Xxxxxxxxxxx	predictive	Élevé
7	TXXXX	CAPEC-136	CWE-XX, CWE-XX	Xxxxxxx Xxxxx Xx Xxxxxxxxxx Xxxxxxxxxx Xxxxxxxxx	predictive	Élevé
8	TXXXX.XXX	CAPEC-178	CWE-XXX	Xxxx Xxxxxxxx	predictive	Élevé
9	TXXXX	CAPEC-0	CWE-XXX	Xxxxxxxxxx Xxxxxx	predictive	Élevé
10	TXXXX	CAPEC-108	CWE-XX	Xxx Xxxxxxxxx	predictive	Élevé
11	TXXXX	CAPEC-37	CWE-XXX	Xxxxxxxxx Xxxxxxx Xx Xxxxxxxxx Xxxxxxxxxxx	predictive	Élevé
12	TXXXX	CAPEC-116	CWE-XXX	Xxxxxxxxxx Xx Xxxxxxx Xxxxx Xxxxxxx Xxxxxxxxx Xxxxxxxxxxx	predictive	Élevé
13	TXXXX.XXX	CAPEC-0	CWE-XX	Xxxxxxxxxxxxx	predictive	Élevé
14	TXXXX	CAPEC-157	CWE-XXX, CWE-XXX	Xxxxxxxxxxxxx Xxxxxx	predictive	Élevé
15	TXXXX.XXX	CAPEC-1	CWE-XXX	Xxxxxxxxxx Xxxxxxxxxxxxxx Xx Xxxxxxxx Xxxx Xxxxxxxxx	predictive	Élevé

IOA - Indicator of Attack (57)

These indicators of attack list the potential fragments used for technical activities like reconnaissance, exploitation, privilege escalation, and exfiltration. This data is unique as it uses our predictive model for actor profiling.

ID	Classe	Indicator	Taper	Confiance
1	File	/etc/passwd	predictive	Moyen
2	File	/etc/sudoers	predictive	Moyen
3	File	/exponent_constants.php	predictive	Élevé
4	File	actions.php	predictive	Moyen
5	File	adclick.php	predictive	Moyen
6	File	add_comment.php	predictive	Élevé
7	File	adminer.php	predictive	Moyen
8	File	xxxxxxx.xxx/xxxxxxxxxxxx.xxx	predictive	Élevé
9	File	xxxxxx_xxxxxx.xxx	predictive	Élevé
10	File	xxxxxxx.xxx	predictive	Moyen
11	File	x:\xxxxxx	predictive	Moyen
12	File	xxxxxx.xxx	predictive	Moyen
13	File	xxxxxx/xxx/x_xxx_xxx_xxxx_xxxx.x	predictive	Élevé
14	File	xxxxxxxxxx.x	predictive	Moyen
15	File	xxx/xxxx/xxx_xxxx.x	predictive	Élevé
16	File	xxx/xxxx/xxxx.x	predictive	Élevé
17	File	xxxxx.xxx	predictive	Moyen
18	File	xxxxxxxxx.xxxxxxxx.xxxxx.xxx.xxx	predictive	Élevé
19	File	xx_xxx_xx.x	predictive	Moyen
20	File	xxxxx.xxx	predictive	Moyen
21	File	xxxxx.xxx	predictive	Moyen
22	File	xxxxxxx.xxx	predictive	Moyen
23	File	xxx_xxx_xxxxxx.x	predictive	Élevé
24	File	xxx/xxxx/xxxxxx.x	predictive	Élevé
25	File	xxx_xxx.x	predictive	Moyen
26	File	xxxx/xxx/xxx_xxxx.x	predictive	Élevé
27	File	xxxx-xxxxxx.x	predictive	Élevé
28	File	xxxxx/xxxx/xxxxxxxx.xxx	predictive	Élevé
29	File	xxxx_xxxxxx	predictive	Moyen
30	File	xx-xxxxxxx/xxxxxxx	predictive	Élevé
31	File	_xxxxxx.xxx	predictive	Moyen
32	Library	/_xxx_xxx/xxxxx.xxx	predictive	Élevé
33	Argument	$_xxxxxx['xxxxx_xxxxxx']	predictive	Élevé
34	Argument	xxx_xxxx	predictive	Moyen
35	Argument	xxxx_xxx	predictive	Moyen
36	Argument	xxx	predictive	Faible
37	Argument	xxxx_xxx	predictive	Moyen
38	Argument	xxxx	predictive	Faible
39	Argument	xxxxx	predictive	Faible
40	Argument	xxxx	predictive	Faible
41	Argument	xx	predictive	Faible
42	Argument	xxxxxxx	predictive	Faible
43	Argument	xxx_xxxxxxx	predictive	Moyen
44	Argument	xxxxxxxxxxxxx	predictive	Élevé
45	Argument	xxxxxxx	predictive	Faible
46	Argument	x_xx_x_x	predictive	Moyen
47	Argument	xxxxxxx_xx_xxxxxxx	predictive	Élevé
48	Argument	xxxx	predictive	Faible
49	Argument	xx_xxxx_xxxxxx_xxxxxxxxxx	predictive	Élevé
50	Input Value	%xx%xx	predictive	Faible
51	Input Value	%x/%x	predictive	Faible
52	Input Value	-x	predictive	Faible
53	Input Value	/../	predictive	Faible
54	Input Value	xxxxxxxx/xxxxxxxx/xxxxxxxxx	predictive	Élevé
55	Input Value	xxxxxx	predictive	Faible
56	Network Port	xxx/xx (xxx xxxxxxxx)	predictive	Élevé
57	Network Port	xxx/xxxxx	predictive	Moyen

Références (3)

The following list contains external sources which discuss the actor and the associated activities:

◂ PrécédentAperçuSuivant ▸

Might our Artificial Intelligence support you?

Check our Alexa App!